Stability of Asynchronously Communicating Systems

Transcription

1 Stability of Asynchronously Communicating Systems Gwen Salaün, Lina Ye To cite this version: Gwen Salaün, Lina Ye. Stability of Asynchronously Communicating Systems. [Research Report] RR-8561, INRIA <hal v2> HAL Id: hal Submitted on 20 Oct 2014 HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

2 Stability of Asynchronously Communicating Systems Gwen Salaün, Lina Ye RESEARCH REPORT N 8561 July 2014 Project-Teams Convecs ISSN ISRN INRIA/RR FR+ENG

3

4 Stability of Asynchronously Communicating Systems Gwen Salaün, Lina Ye Project-Teams Convecs Research Report n 8561 version 2 initial version July 2014 revised version October pages Abstract: Recent software is mostly constructed by reusing and composing existing components. Software components are usually stateful and therefore described using behavioral models such as finite state machines. Asynchronous communication is a classic interaction mechanism used for such software systems. However, analyzing communicating systems interacting asynchronously via reliable FIFO buffers is an undecidable problem. A typical approach is to check whether the system is bounded, and if not, the corresponding state space can be made finite by limiting the presence of communication cycles in behavioral models or by fixing buffer sizes. In this paper, our focus is on systems that are likely to be unbounded and therefore result in infinite systems. We do not want to restrict the system by imposing any arbitrary bounds. We introduce a notion of stability and prove that once the system is stable for a specific buffer bound, it remains stable whatever larger bounds are chosen for buffers. This enables us to check certain properties on the system for that bound and to ensure that the system will preserve them whatever larger bounds are used for buffers. We also prove that computing this bound is undecidable but we show how we succeed in computing these bounds for many typical examples using heuristics and equivalence checking. Key-words: Communicating Systems, Labelled Transition Systems, Unbounded Buffers, Automated Verification Grenoble INP, Inria, France Inria RESEARCH CENTRE GRENOBLE RHÔNE-ALPES Inovallée 655 avenue de l Europe Montbonnot Saint Ismier Cedex

5 Stabilité des systèmes communicants de façon asynchrone Résumé : Le logiciel moderne est principalement construit par réutilisation et composition de composants existants. Les composants logiciels sont souvent décrits par des modèles comportementaux tels que des machines à états. La communication asynchrone est un mécanisme de communication classique pour les systèmes logiciels. Cependant, analyser des systèmes communicants intergaissant de façon asynchrone au travers de buffers FIFO est un problème indécidable. Une approche habituelle est de vérifier si le système est borné, et s il ne l est pas, l espace d états correspondant peut être rendu fini en limitant la présence de cycles de communication dans les modèles ou en fixant une taille arbitraire aux buffers. Dans ce rapport, nous nous focalisons sur des systèmes non-bornés et donc infinis. Nous ne voulons pas imposer de restriction arbitraire au système. Nous introduisons une notion de stabilité et prouvons que lorsque le système est stable pour une borne spécifique, il reste stable pour des bornes plus élevées. Cela permet de vérifier que certaines propriétés sont satisfaites par le système pour cette borne, et assure que ces propriétés seront préservées pour des tailles supérieures de buffers. Nous avons aussi prouvé que calculer cette borne n est pas décidable mais nous somme capables en pratique de trouver cette borne pour de nombreux exemples en utilisant des heuristiques et la vérification d équivalence. Mots-clés : Systèmes communicants, systèmes de transitions étiquetées, buffers non bornés, vérification automatique

6 Stability of Asynchronously Communicating Systems 3 1 Introduction Most software systems are now constructed by reusing and composing existing components or peers. This is the case in many different areas such as component-based systems, cloud applications, Web services, or cyber-physical systems. Software entities are often stateful and therefore described using behavioral models. Moreover, asynchronous communication via FIFO buffers is a classic communication model used for such distributed, communicating systems. A crucial problem in this context is to check whether a new system consisting of a set of interacting peers respects certain properties. Analyzing asynchronously communicating software has been studied extensively in the last 30 years and is known to be undecidable in general [10]. A common approach to circumvent this issue is to bound the state space by restricting the cyclic behaviors or imposing an arbitrary bound on buffers. Bounding buffers to an arbitrary size during the execution is not a satisfactory solution: if at some point buffers sizes change (due to changes in memory requirements for example), it is not possible to know how the system would behave compared to its former version and new unexpected errors can show up. In this paper, we do not want to impose any arbitrary bounds for buffer sizes. Hence, our focus is on systems that are likely to be unbounded and therefore result in infinite state spaces. It was shown recently that certain properties of distributed systems interacting asynchronously through unbounded buffers can be checked using the synchronizability property. [4] relies on this property to check whether a choreography is realizable and [39] uses it for verifying the compatibility of communicating systems. A set of peers is synchronizable if and only if the system generates the same sequences of messages under synchronous and unbounded asynchronous communication, considering only the ordering of the send actions and ignoring the ordering of receive actions. Focusing only on send actions makes sense for verification purposes because: (i) send actions are the actions that transfer messages to the network and are therefore observable, (ii) receive actions correspond to local consumptions by peers from their buffers and can therefore be considered to be local and private information. Synchronizability can be verified by checking the equivalence of the synchronous and 1-bounded asynchronous compositions of the given system. In the 1- bounded asynchronous composition, each peer is equipped with one input buffer bounded to size 1. Thus, this property can be verified using equivalence checking techniques on finite state spaces, although the system consisting of peers interacting asynchronously via unbounded buffers can result in infinite state spaces. Figure 1 gives an example where peers are modelled using Labelled Transition Systems (LTSs). Transitions are labeled with either emissions (exclamation marks) or receptions (question marks). Initial states are marked with incoming half-arrows. This simple system is synchronizable because the synchronous system consists of sequences of interactions request, result, and ack, and this order is the same in the 1-bounded asynchronous system considering only send actions. Figure 1: Motivating Example (1) Let us now focus on a sligthly extended version of this example where in addition the server RR n 8561

7 4 Salaün & Ye stores every request answered in a database (log) as depicted in Figure 2. This system is not synchronizable because the client can submit a second request in the 1-bounded asynchronous system before the server sends the log message to the database, and this behavior is not possible in the synchronous composition. Synchronizability is rather strong and many communicating systems do not satisfy this property. So what can we do for non-synchronizable systems? This second example is typically unbounded, because the database peer has no obligation to consume from its buffer which can infinitely receive log messages. So far, and to the best of our knowledge, existing approaches cannot analyze such infinite-state systems. Figure 2: Motivating Example (2) In this paper, we propose a new approach for analyzing a set of peers described using LTSs, communicating asynchronously via reliable (no loss of messages) and possibly unbounded FIFO buffers. We do not want to restrict the system by imposing any arbitrary bounds on cyclic behaviors or buffers. We introduce a notion of stability for the asynchronous versions of the system. A system is stable if asynchronous compositions exhibit the same observable behavior from some buffer bound. We prove that once the system is stable for a specific buffer bound, it remains stable whatever larger bounds are chosen for buffers. This enables one to check temporal properties on the system for that bound (using model checking techniques for instance) and ensures that the system will preserve them whatever larger bounds are used for buffers. Practically speaking, this allows any developer to check that his/her system satisfies some property for the minimal k satisfying stability, and then (s)he can choose any bound from that k as actual parameter for his/her system. This choice may be guided by memory constraints or performance issues for instance. We also prove that computing this bound is undecidable, but we show how we succeed in computing such bounds in practice for many examples. Going back to the former example (Fig. 2), we can use our approach to detect that when each peer is equipped with a buffer bound fixed to 2, the observable behavior of this system is stable. This means that we can check properties, such as the absence of deadlocks, on the 2-bounded asynchronous version of the system and the results hold for any asynchronous version of the system where buffer bounds are greater or equal to 2. We implemented our approach in a tool that first encodes the peer LTSs and their compositions into process algebra, and then uses heuristics, search algorithms, and equivalence checking techniques for verifying whether the system satisfies the stability property. If this is the case, we return the smallest bound respecting this property. Otherwise, when we reach a certain maximal bound, our check returns an inconclusive result. Heuristics and search algorithms aim at guiding the approach towards the smallest bound satisfying stability whereas equivalence checking techniques is used for checking the stability property given a specific bound k. All the steps of our approach are fully automated (no human intervention). We applied our tool support to more than 300 examples of communicating systems, many of them taken from the literature on this topic. These experiments show that a large number of these examples are stable and can therefore be formally analyzed using our approach. Inria

8 Stability of Asynchronously Communicating Systems 5 Our contributions with respect to existing results on formal verification of asynchronously communicating systems are the following: A general framework for verifying systems interacting asynchronously via reliable FIFO buffers; The introduction of the stability property for such systems and a proof showing that stability once acquired for a specific bound k is preserved for upper bounds; A proof demonstrating that computing this bound k is undecidable; A fully automated tool support that implements the presented approach and was applied to many examples for evaluation purposes. The organization of the rest of this paper is as follows. Section 2 defines our models for peers and their synchronous/asynchronous compositions. Section 3 presents the stability property and our results on stable systems. Section 4 describes our tool support and experiments we carried out to evaluate our approach. Finally, Section 5 reviews related work and Section 6 concludes. 2 Communicating Systems We use Labeled Transition Systems (LTSs) for modeling peers. This behavioral model defines the order in which a peer executes the send and receive actions. Definition 1 A peer is an LTS P = (S,s 0,Σ,T) where S is a finite set of states, s 0 S is the initial state, Σ = Σ! Σ? {τ} is a finite alphabet partitioned into a set of send messages, a set of receive messages, and the internal action, and T S Σ S is a transition relation. We write m! for a send message m Σ! and m? for a receive message m Σ?. We use the symbol τ for representing internal activities. A transition is represented as s l s T where l Σ. This can be directly extended to s σ s, σ Σ, where σ = l 1,...,l n, s l1 l i+1 s 1,...,s i l s i+1,...,s n n 1 s T. In the following, for the sake of simplicity, we will denote this by s σ s T. We assume that peers are deterministic on observable messages meaning that if there are several transitions going out from one peer state, and if all the transition labels are observable, then they are all different from one another. Observable determinism can be easily obtained in peers using standard determinization algorithms [31]. Nondeterminism can also result from internal choices when several transitions (at least two) outgoing from a same state are labeled with τ. It is worth observing that these internal transitions are important when checking the synchronizability property [4, 39], which partly relies on synchronous communication. In such a case, internal transitions outgoing from a same state express an internal choice whereas transitions labeled with observable messages outgoing from a same state stand for an external choice semantics. Given a set of peers {P 1,...,P n }, we assume that each message has a unique sender and a unique receiver: i,j 1..n, i j, Σ! i Σ! j = and Σ? i Σ? j =. Furthermore, each message is exchanged between two different peers: Σ! i Σ? i = for all i. We also assume that each emission has a reception counterpart in another peer (closed systems): i 1..n, m Σ! i = j 1..n, i j, m Σ? j. The synchronous composition of a set of peers corresponds to the system where a communication occurs when one peer can send a message and another peer is in a state in which that message can be received. RR n 8561

9 6 Salaün & Ye Definition 2 (Synchronous Composition) Given a set of peers {P 1,..., P n } with P i = (S i,s 0 i,σ i,t i ), the synchronous composition is the labeled transition system LTS s = (S s,s 0 s,σ s,t s ) where: S s = S 1... S n s 0 s S s such that s 0 s = (s 0 1,...,s 0 n) Σ s = i Σ i T s S s Σ s S s, and for s = (s 1,...,s n ) S s and s = (s 1,...,s n) S s (interact) s m s T s if i,j {1,...,n} where i j : m Σ! i Σ? j where s i m? and s j s j T j such that k {1,...,n},k i k j s k = s k m! s i T i, (internal) s τ s T s if i {1,...,n}, s i τ s i T i such that k {1,...,n},k i s k = s k In the asynchronous composition, the peers communicate with each other asynchronously via FIFO buffers. Each peer P i is equipped with an unbounded input message buffer Q i. A peer can either send a message m Σ! to the tail of the receiver buffer Q j at any state where this send message is available, read a message m Σ? from its buffer Q i if the message is available at the buffer head, or evolve independently through an internal transition. We recall that we focus on send actions in this paper. We consider that reading from the buffer is private non-observable information, which is encoded as an internal transition in the asynchronous system. Definition 3 (Asynchronous Composition) Given a set of peers {P 1,..., P n } with P i = (S i,s 0 i,σ i,t i ), and Q i being its associated buffer, the asynchronous composition is the labeled transition system LTS a = (S a,s 0 a,σ a,t a ) where: S a S 1 Q 1... S n Q n where i {1,...,n}, Q i (Σ? i ) s 0 a S a such that s 0 a = (s 0 1,ǫ,...,s 0 n,ǫ) (where ǫ denotes an empty buffer) Σ a = i Σ i T a S a Σ a S a, and for s = (s 1,Q 1,...,s n,q n ) S a and s = (s 1,Q 1,...s n,q n) S a (send) s m! s T a if i,j {1,...,n} where i j : m Σ! i Σ? j, (i) s m! i s i T i, (ii) Q j = Q jm, (iii) k {1,...,n} : k j Q k = Q k, and (iv) k {1,...,n} : k i s k = s k (consume) s τ s T a if i {1,...,n} : m Σ? i, (i) s m? i s i T i, (ii) mq i = Q i, (iii) k {1,...,n} : k i Q k = Q k, and (iv) k {1,...,n} : k i s k = s k (internal) s τ s T a if i {1,...,n}, (i) s i τ s i T i, (ii) k {1,...,n} : Q k = Q k, and (iii) k {1,...,n} : k i s k = s k We use LTS a for the same asynchronous composition where the receptions (consume rule in Def. 3) are kept in the resulting LTS (s m? s T a ) instead of being encoded as τ. Furthermore, we use LTSa k = (Sa,s k 0 a,σ k a,ta) k to define the bounded asynchronous composition, where each message buffer is bounded to size k. The definition of LTSa k can be obtained from Def. 3 by Inria

10 Stability of Asynchronously Communicating Systems 7 allowing send transitions only if the message buffer of the receiving peer has less than k messages in it. Otherwise, the sender is blocked, i.e., we assume reliable communication without message losses. As it is well-known for asynchronously communicating systems, LTS k a (LTS k a), we have LTS k a LTS q a ( q k) (LTS k a LTS q a ( q k)). 3 Stability In this section, we introduce successively the synchronizability property, the stability property, the proof of undecidability for the stability property, and several other results on stable systems. 3.1 Synchronizability The composition of finite peer LTSs can result into an infinite state system if these peers communicate asynchronously over unbounded buffers. This makes the exhaustive analysis of all executed communication traces impossible and verification tasks in this setting are undecidable [10]. This issue can be avoided for systems that are synchronizable [4]. The synchronizability property checks whether the sequences of send actions generated by the peer composition remain the same under synchronous and asynchronous communication semantics. This enables one to analyze asynchronous systems, even those generating an infinite state space, using the synchronous version of the given system (which has a finite state space). This property was used recently for analyzing properties on communicating systems [39] and is checked using branching equivalence [47], which is the finest equivalence notion in presence of internal behaviors. Definition 4 (Branching Bisimulation) Given two LTSs LTS 1 and LTS 2, they are branching bisimilar, denoted by LTS 1 br LTS 2, if there exists a symmetric relation R (called a branching bisimulation) between the states of LTS 1 and LTS 2 satisfying the following two conditions: The initial states are related by R; If R(r,s) and r δ r, then either δ = τ and R(r,s), or there exists a path s τ δ s 1 s, such that R(r,s 1 ) and R(r,s ). For the sake of simplicity and consistency, the relation R is replaced by br in the rest of this paper, i.e.,, R(r,s) is noted r br s. Definition 5 (Branching Synchronizability) A set of peers {P 1,...,P n } is branching synchronizable if k 1, LTS s br LTS k a, where br in that particular case compares synchronizations in the synchronous composition with emissions from peers to peer buffers in the asynchronous composition. It was proved that LTS s br LTS 1 a is a sufficient and necessary condition for branching synchronizability [39]. The synchronizability property is quite strong and there are many non-synchronizable systems, see e.g., Fig. 2. If the set of peers is not synchronizable, there is no standard approach for formally analyzing those systems. The stability notion we introduce in the next section is a solution to this problem. RR n 8561

11 8 Salaün & Ye 3.2 Stability In this section, we show that systems consisting of a finite set of peers involving cyclic behaviors and communicating over FIFO buffers may stabilize from a specific buffer bound k. We call this property stability and we say that the corresponding systems are stable. The class of systems which are stable corresponds to systems whose asynchronous compositions remain the same from some buffer bound when we observe send actions only (we ignore receive actions and buffer contents). Stability results do not hold if we consider that receptions are also observable. Focusing only on send actions makes sense for verification purposes because: (i) send actions are the actions that transfer messages to the network and are therefore observable, (ii) receive actions correspond to local consumptions by peers from their buffers and can therefore be considered to be local and private information. Since stable systems produce the same behavior from a specific bound k, they can be analyzed for that bound to detect for instance the presence of deadlocks or to check whether they satisfy any kind of temporal properties. Stability ensures that these properties will be also satisfied for larger bounds. The stability definition relies on branching equivalence checking, and this equivalence preserves properties written with ACTL\X logic [38]. Contrarily, some systems are not stable. Unstability is due to some particular cycle dependency in the peer behaviors that makes the asynchronous composition exhibit new behaviors every time the buffer bound is increased. In the rest of this section, we will first define the stability property. We will show how stability is established and what can be deduced for such systems. We will also present other results such as the undecidability of the stability problem. Definition 6 (Stability) Given a set of peers {P 1,...,P n }, we say that this system is stable if and only if k such that LTS k a br LTS q a ( q > k). Before presenting our main results, we first introduce a few definitions that will be used in the following deduction. First, we define a special state of LTSa k as a border state that is considered as a boundary between LTSa k and LTSa k+1 if the latter has more behaviors than the former due to larger buffers. Precisely, a border state of LTSa k should satisfy a condition stating that it has a successor state in LTSa k+1 that is not reachable in LTSa k due to limited buffer size. Then the new behavior, which leads to a state whose buffers contain k+1 messages that are not contained in LTSa, k must begin after this border state. Definition 7 (Border State) Given a set of peers {P 1,...,P n }, given a state s k = (s k 1,Q k 1,...,s k n, Q k n) S k a, if it satisfies the following condition, we call it a k-border state, simply a border state if there is no ambiguity: s k m! s k T k+1, where s k has one peer whose buffer contains k +1 messages. a A single k-message state is a state where only one buffer contains k messages. Note that such a state cannot be reachable in LTSa k 1 and we must have such a state as a successor state for a (k 1)-border state in LTSa k according to the condition of Definition 7. Characterizing such states is a key step for demonstrating some of our results, i.e., Lemma 1 and Theorem 1. Definition 8 (Single k-message State (SG(s k ))) Given a set of peers {P 1,...,P n } and a state s k = (s k 1,Q k 1,...,s k n,q k n) Sa, k if i {1,...,n}, Q k i = k, j {1,...,n},j i, Qk j < k, and there exists a border state s k 1 k 1 m! such that s s k Ta,m? k Σ k i, then sk is a single k-message state, denoted by SG(s k ). Inria

12 Stability of Asynchronously Communicating Systems 9 Figure 3: A single k-message state (left part) and a loose k-message state (right part). In the left part of Figure 3, the small ellipsis represents LTSa k 1 and the bigger one is LTSa. k Here, s k Sa k is a single k-message state and s k 1 Sa k 1 is the corresponding border state. Next we define a special state s k in LTSa k such that it contains only one buffer with k messages, whose precedent state is a border state, denoted by s b. Furthermore, from s b, there are two outgoing transitions. One can reach s k with one emission. The other can reach another state s k 1 through a reception followed by the same emission such that s k 1 contains at most k 1 messages in its buffers. Then we will show s k br s k 1 by demonstrating that these two traces diverging from s b will converge in the future, i.e., there will form a confluent diamond. Definition 9 (Loose k-message State (LS(s k ))) Given a set of peers {P 1,...,P n } and a m! state s k such that SG(s k ), i.e., sm k 1 s k Ta, k m? Σ? i,i {1,...,n}, where sk 1 m is a border state, then s k is called a loose k-message state, denoted by LS(s k ), if the following conditions are satisfied m? Σ? i Ta k ;, such that sk 1 m m? s k 1 n for s k and s k 1, we have s k br s k 1 m! s k 1, where s k 1 m m? sn k 1,sn k 1 m! s k 1 In the right part of Figure 3, s k Sa k is a loose k-message state which is a single k-message state satisfying the above condition. Next we will show that for a given single k-message state, it has a corresponding branching equivalent state in LTSa k 1 iff it is a loose k-message state. The proof is based on the fact that branching equivalence between two states s k Sa k and s k+1 Sa k+1 s k+1 / Sa k implies a confluent diamond for them in LTSa k+1. Lemma 1 Given a set of peers {P 1,...,P n }, the following holds for each single k-message state s k S k a. LS(s k ) s k 1 S k 1 a such that s k 1 br s k Proof. Suppose that for a single k-message state s k = (s k 1,Q k 1,...,s k n, Q k n) Sa, Q k k i = k,i {1,...,n}, LS(s k ) holds. Then in LTSa, k m? Σ? i, such that sk σ 0 s k m! m s k, where s k σ 0 s k m T k m! s k Ta k. From Definition 9, we know that s k m is a border state and that m? Σ? i, a,s k m s k σ 0 s k m? m s k m! n s k, where s k m? m s k n,s k n be a corresponding part in LTSa k 1 : s0 k 1 σ sm k 1 Ta k 1,sm k 1 m? sn k 1,sn k 1 m! s k 1 Ta k 1 m! s k Ta k. This implies that there must m? sn k 1 m! s k 1, where s0 k 1 σ sm k 1, s k 1 = (s k 1 1,Q k 1 1,...,s n k 1, Q k 1 n ), Q k 1 j < RR n 8561

13 10 Salaün & Ye k, j {1,...,n}. The reason is that the maximum number of messages in all states between s0 k 1 and s k 1 is smaller than k. Now from the second condition of Definition 9, we know that beginning from the state s k in LTSa k and from s k 1 in LTSa k 1, we have exactly the same branching structure. This implies s k br s k 1. Now suppose that in LTSa, k we have a single k-message state s k = (s k 1,Q k 1,...,s k n,q k n) Sa, Q k k i = k,i {1,...,n}, such that LS(sk ) does not hold. From Definition 9, we show that the violation of each one of the two conditions implies s k 1 Sa k 1, such that s k br s k 1. m? s k n m! s k, where 1. If the first condition is not satisfied, i.e., m? Σ? i, such that sk m s k m? m s k n,s k m! n s k Ta k. This implies that the reception of m that is contained in the buffer Q k i cannot be executed between the border state sk m and the state juste before m!. If m? is executed after m! preceding the border state, then there is no equivalent state in LTSa k 1 with respect to s k since the part after the border state cannot be reached in LTSa k 1. Otherwise, if m? is before the border state, e.g., suppose s k l!/? h s k m! m s k, where s k l!/? h s k m,s k m! m s k Ta k, we have s k m? h s k l!/? p s k m! q s k r, where s k m? h s k p,s k l!/? p s k q,s k m! q s k r Ta k. In this case, we can deduce that m? should execute before l!/?. In other words, s k m? s Ta k. This means that we cannot reach s k r from s k, i.e., there is no confluent diamond. Thus, there is no branching equivalent state in LTSa k 1 for s k. m? m! m? 2. m? Σ? g, s k m s k n s k, where s k m s k n,s k m! n s k Ta k, s k br s k. It is clear that we have also s k br s k n since m! is before s k but after s k n. Thus, there is no branching equivalent state in LTSa k 1 for the state s k. From above, if a single k-message state is not a loose one, then s k 1 Sa k 1 s k. Thus, we have proved this lemma for both directions. such that s k 1 br Here is one of the main results of this paper. If we are able to find a bound k such that the k-bounded and the (k + 1)-bounded asynchronous systems are branching equivalent, then we prove that the system remains stable, meaning that the observable behavior is always the same for any bound greater than k. The main interest of the stability property is that the k-bounded version of the system can be analyzed using existing model checking tools and this result ensures that these properties are preserved when buffer bounds are increased or if buffers are unbounded. Theorem 1 Given a set of peers {P 1,...,P n }, if k N, such that LTSa k br LTSa k+1, then we have LTSa k br LTSa, q q > k. Proof. We prove this theorem by induction. The idea is to showltsa k br LTSa, q q > k fromltsa k br LTSa k+1. We rewrite q > k by q = k + m,m 1. Now the base case m = 1 is true from the hypothesis, i.e., LTSa k br LTSa k+1. To prove that this is also true for m > 1, we suppose LTSa k br LTSa k+1 br... br LTSa k+m,m 1 and we show LTSa k br LTSa k+m+1. To do this, we consider two cases according to whether the maximum number of messages in all buffers is smaller than k+m+1 or not in the asynchronous composition, which are formally represented as follows: 1. In LTS k+m+1 a i {1,...,n}, Q k+m+1 i, s k+m+1 = (s k+m+1 1,Q k+m+1 k +m; 1,...,sn k+m+1, Q k+m+1 n ) Sa k+m+1, we have Inria

14 Stability of Asynchronously Communicating Systems In LTS k+m+1 a i {1,...,n}, Q k+m+1 i, s k+m+1 = (s1 k+m+1,q k+m+1 = k +m+1. 1,...,sn k+m+1, Q k+m+1 n Now we show that in each of the two cases, we can deduce LTS k a br LTS k+m+1 a. ) Sa k+m+1, such that The first case implies that in the asynchronous composition of this set of peers LTS a, the buffer of any peer contains at most k+m messages in all states of LTS a. Hence, LTSa k+m+1 is exactly the same LTS as LTSa k+m. This implies LTSa k+m+1 br LTSa k+m. From the inductive hypothesis LTSa k br LTSa k+m, we have LTSa k br LTSa k+m+1. In the second case, since there exists a buffer containing k + m + 1 messages, there are new states in LTSa k+m+1 that are not in LTSa k+m. Now from the inductive hypothesis, we have LTSa k+m 1 br LTSa k+m. Then from Lemma 1, we can deduce that for each single (k + m)-message state s k+m in LTSa k+m, we have LS(s k+m ), i.e., s k+m 1 Sa k+m 1, such that s k+m 1 br s k+m. From Definition 9, we know that the only difference between the path from s 0 a to s k+m 1 and that from s 0 a to s k+m is that the former has one more reception that has however no impact on the execution after s k+m 1 since s k+m 1 br s k+m. This implies that we have exactly the same structure with respect to emissions from the states s k+m 1 and s k+m. Now suppose that LTSa k+m br LTSa k+m+1, i.e., s k+m+1 Sa k+m+1, for which s k+m Sa k+m, such that s k+m+1 br s k+m. In other words, we have SG(s k+m+1 ) and LS(s k+m+1 ). Now let s k+m be the border state for s k+m+1, we can deduce that if LS(s k+m+1 ), for its border state s k+m, s k+m 1 Sa k+m 1, such that s k+m br s k+m 1. In other words, LS(s k+m+1 ) implies LS(s k+m ). It follows that LTSa k+m 1 br LTSa k+m, which contradicts our inductive hypothesis. Thus we must have LTSa k+m br LTSa k+m+1. From above, based on LTSa k br... br LTS k+m, we prove br LTS k+m+1 LTS k+m a a. This proves the theorem. Given this result, one can check on the minimal k-bounded system satisfying stability, any temporal property written with ACTL\X logic involving emissions, and this property will hold for any system with larger bounds. Proposition 1 Given a set of peers {P 1,...,P n }, if k s.t. LTS k a br LTS q a ( q > k), and for some property P, LTS k a = P, then LTS q a = P ( q > k). Proof. This trivially follows from Theorem Undecidability Before showing the undecidability of checking the stability of a system, we first present a sufficient and necessary condition for a system that is stable. Lemma 2 Given a set of peers {P 1,...,P n }, this system is stable iff the following condition is satisfied, denoted by C: k N, s k S k a.[ SG(s k ) LS(s k )]. RR n 8561

15 12 Salaün & Ye Proof. Suppose that the given set of peers is stable. Next we show that the stability of the set of peers implies that the condition C is satisfied. Since this set of peers is stable, from Theorem 1, we deduce k N, such that LTSa k br LTSa k 1. There are two cases for this: 1. LTS k a = (S k a,s 0 a,σ k a,t k a) and LTS k 1 a structure, i.e., S k a = S k 1 a,σ k a = Σ k 1 a = (Sa k 1,Ta k = T k 1 a ;,s 0 a,σ k 1 a, Ta k 1 ) have exactly the same 2. LTSa k and LTSa k 1 do not have the same structure but are branching equivalent, i.e., Sa k Sa k 1 and Ta k T k 1 a. We demonstrate that any one of the two cases must satisfy the condition C. In the first case, we can deduce that in LTS k a, for each peer, its buffer contains at most k 1 messages in all states, i.e., s k = (s k 1,Q k 1,...,s k n,q k n) S k a, i {1,...,n}, Q k i < k. This implies that there is no single k-message state in LTS k a, i.e., s k S k a, SG(s k ). Hence, the condition C is satisfied. Now consider the second case, where LTSa k and LTSa k 1 are not exactly the same one. Hence, we can deduce s k = (s k 1,Q k 1,...,s k n,q k n) Sa, i k {1,...,n}, Q k i = k in LTSk a. In other words, there exists at least one single k-message state. Furthermore, since LTSa k br LTSa k 1, for all states in LTSa, k there must be a corresponding branching equivalent state in LTSa k 1, including all single k-message states. Thus, from Lemma 1, we can deduce that s k Sa, k we have either SG(s k ) or LS(s k ). This means that the condition C is satisfied. So if the set of peers is stable, then the condition C must be satisfied. Now suppose that the condition C is satisfied. Thus, we consider three cases: all states are not single k-message states, formally described by the first case in the following; all states are loose k-message states, which is not possible since the initial state has no message in all buffers; some of the states are single k-messages states that should be loose ones, formally presented by the second case below: 1. k N, s k S k a, we have SG(s k ); 2. k N, s k S k a such that SG(s k ), we have LS(s k ). Now we show that any one of these two conditions implies that the system is stable. The first condition means that in LTSa, k there is no single k-message state, i.e., the maximum number of messages in buffers is smaller than k for any state. It can thus be deduced thatltsa k andltsa k 1 have exactly the same structure, which impliesltsa k br LTSa k 1. From Theorem 1, this is a stable set of peers. The second condition means that all single k-message state in LTSa k are loose ones. From Lemma 1, it can be deduced that s k Sa, k there is a corresponding state s k 1 Sa k 1, such that s k br s k 1. It is clear that s k Sa k 1, we have at least one corresponding branching equivalent state in LTSa. k This implies that LTSa k br LTSa k 1. Hence, this set of peers is stable from Theorem 1. Hence, if the condition C is satisfied, then the system is stable. Next we show that checking the stability of the system is undecidable by showing that verifying the condition C is an undecidable problem. Yet there are many cases in which stability is satisfied and the corresponding bound can be computed in those cases using heuristics, search algorithms, and equivalence checking (see Section 4). Inria

16 Stability of Asynchronously Communicating Systems 13 Theorem 2 Given a set of peers {P 1,...,P n }, it is undecidable whether the corresponding asynchronous system is stable. Proof. From Lemma 2, we know that C is a sufficient and necessary condition to check that a system is stable. We show that the problem of checking this condition is undecidable. The idea is to demonstrate that the boundedness problem [10] is its subproblem. The communication of a set of peers with FIFO buffers is said to be bounded iff k N such that for any reachable state s = (s 1,Q 1,...,s n,q n ) S a, we have i {1,...,n}, Q i < k. Now recall that to check whether the condition C is violated, the following two conditions should be both checked one after another: k N, s k S k a, such that SG(s k ); LS(s k ). Now we show that the first condition is equivalent to the boundedness problem. If this condition is satisfied, it can be deduced that k N, such that s = (s 1,Q 1,...,s n,q n ) S a, we have i {1,...,n}, Q i < k. So this system is not bounded. On the other hand, if the condition is not satisfied, i.e., k N, there does not exist a reachable state such that it is a single k-message state. This means that s k = (s k 1,Q k 1,...,s k n,q k n) S k a, we have SG(s k ). From Definition 8, to have SG(s k ), consider three cases for s k : 1) at least two buffers contain k messages, i.e., i 1,...,i m {1,...,n}, Q k i j = k,j {1,...,m},m 2; 2) no buffer contains k messages, i.e., i {1,...,n}, Q k i < k; 3) there does not exist a border state sk 1 k 1 m! such that s s k Ta k, where SG(s k ). For the first case, if this is true, there must be at least one s k such that SG(s k ) since to reach a state where more than one buffer has k messages, we have to first reach such a state s k, SG(s k ). This implies that the first case is not possible with the assumption without single k-message states. Then the second case means that the maximum number of messages in buffers is smaller than k. And for the third case, even in s k, there exists a buffer containing k messages, this state cannot be reached in LTSa k since there is no border state before it. From above, we analyze all three cases for a state s k such that SG(s k ). We can see that SG(s k ) implies that s k is bounded by k. This implies that if s k Sa, k we have SG(s k ), then the system is bounded. So we have shown that this first condition is equivalent to the boundedness problem, which is thus a subproblem of checking C: consequently, if the former is undecidable, which was proved in [10], then so is the latter. 3.4 Other Results In the rest of this section, we present several additional results on the stability of communicating systems. Proposition 2 A set of peers {P 1,...,P n } is stable if it is synchronizable. Proof. From Definition 5, a system is synchronizable meaning that all its asynchronous compositions are branching equivalent whatever is the bound for buffers. This means that k,q N, we have LTS k a br LTS q a. Now from Definition 6, it follows that this system is stable. The opposite is false because stability ensures branching equivalence of the asynchronous systems from a specific bound k, which means that systems for lower bounds and for its synchronous version behave differently. The next result concerns computability of the smallest buffer bound for stable systems. RR n 8561

17 14 Salaün & Ye Proposition 3 Given a stable set of peers {P 1,...,P n }, the minimal bound k satisfying the stability property is computable. Proof. Since this set of peers is stable, from Theorem 1, we know that k N,LTSa k br LTSa k+1. Since k is finite, the construction of LTSa, k LTSa k+1 and their equivalence checking is computable. Hence, the minimal bound k for the stability property is also computable. The computability of the stability property will be illustrated on real-world examples in Section 4 by using heuristics, search algorithms, and equivalence checking. Beyond these results on stability, a common approach is to identify classes of systems where stability is guaranteed. Synchronizable systems (Prop. 3) and finite systems lie in this category. By finite systems, we mean systems where peers interact over unbounded FIFO buffers and whose asynchronous compositions are finite. This is the case for instance for acyclic peers, for systems with a single cyclic peer where cycles do not involve only emissions, or for systems with peers exhibiting independent cycles, i.e., cycles that are not included one from another [34]. Apart from these simple cases, two candidates are (i) systems where peers exhibit cycles of emissions, and (ii) well-formed systems (Definition 10). Let us start with systems where peers can infinitely send messages. We establish that the existence of a cycle of emissions in one peer does not determine whether whether the system is stable or not, which is however a sufficient condition for unboundedness [10]. Proposition 4 Given a set of peers {P 1,...,P n }, if a peer P i {P 1,...,P n } exhibits a cycle of emissions φ = s k m 1! i s k+1... mn! s k i, this does not imply that the system is unstable. i Proof. We prove this result by demonstrating that a system with a cycle of emissions in one peer that is able to infinitely send messages may be stable or not. Suppose first that for this system, in LTS a, σ Σ a,s 0 σ n 1 mi! a s s n,s 0 σ a s n 1 Ta,s n 1 mi! s n T a, where m i! is one send message in φ, then σ Σ a,s 0 σ m 1 mi! a s s m mi? s m+1,s 0 σ a s m 1 Ta, m 1 mi! s s m,s m mi? s m+1 T a, where P! (σ) = P! (σ ). Here we denote the projection of σ on send messages by P! (σ). This means that whenever a message in this cycle is emitted, there exists at least one execution with the same sequence of emissions, where the corresponding peer is ready to receive it. In this case, the system may be stable. Now suppose that in this system, σ Σ a,s 0 σ n 1 mi! a s s n,s 0 σ a s n 1 Ta,s n 1 mi! s n T a, where m i! is one send message in φ, for which σ Σ a,s 0 σ m 1 mi! a s s m mi? s m+1, such that s 0 σ a s m 1 Ta,s m 1 mi! s m,s m mi? s m+1 T a, where P! (σ) = P! (σ ). This means that σ Σ a, s 0 σ m 1 mi! a s s m σ s t mi? s t+1, where s 0 σ a s m 1,s m σ s t Ta m 1 mi! and s s m,s t m i? s t+1 T a. Next we show that there is at least one send message in the sequence σ. This can be proved by assuming that all messages in σ are receive messages, which in turn implies s 0 σ a s m mi! s n mi? s n+1 and thus a contradiction. So it is clear that in σ, we must have at least one send message. This implies that k N, in LTS k+1 s 0 σ s m mi! s n m (i+1) mod n! s n+1... m (i+j) mod n! s n+j, whose corresponding part in LTSa k is s 0 σ s m mi! s n m (i+1) mod n! s n+1 m (i+j 1) mod n!... s n+j 1. This implies LTSa k br LTSa k+1 and the system is thus not stable. a, Inria

18 Stability of Asynchronously Communicating Systems 15 The example shown in Figure 4 has a cycle of emissions. In its synchronous composition, before entering this cycle, d! should be synchronized with d? only after c! while c! can only be synchronized with c? after d!, which leads to a deadlock. It follows that this system is not synchronizable due to this deadlock, which is however not the case for its asynchronous composition. This means that there is no branching equivalence between the synchronous and asynchronous compositions. However, it is stable from bound 1, i.e., LTS 1 a br LTS k a,k > 1. Figure 4: A Stable System Exhibiting a Cycle of Emissions Figure 5 depicts another example with a cycle of emissions that is not stable. For this example, if we first execute a! and b! before c!, then to read the receive message from the buffer of peer 2, we have to wait for c!. Hence, consider the execution where c is still not sent. We have always exhibits a new observable behavior compared to LTSa. k The reason is that the cycle of emissions in peer 1 can infinitely send a and b, which is only constrained by the size of buffer in peer 2. This implies that this system is not stable. Another result concerns well-formed systems [4]. A system consisting of a set of peers is well-formed iff whenever the size of the buffer, Q i, of the i-th peer is non-empty, the system can move to a state where Q i is empty. In other words, well-formedness concerns the ability of a system to eventually consume all messages in any of its buffers. In order to check this property, we have to keep receive messages and thus analyze it on LTS a instead of LTS a. that k, LTS k+1 a Definition 10 (Well-formed System) Given a set of peers {P 1,..., P n }, it is well-formed, denoted by WF(LTS a ), if s = (s 1,Q 1,...,s n,q n ) S a, Q i, such that Q i > 0, then s σ s T a, where s = (s1,q 1,...,s n,q n ) S a, Q i = 0. Proposition 5 The well-formedness of a set of peers {P 1,..., P n } can be checked with the following CTL temporal formula on its asynchronous composition LTS a : AG( Q i > 0) EF( Q i = 0) This formula means that whenever the size of any buffer is non-empty, i.e., AG( Q i > 0), then there is at least one execution in the system to move to a state where Q i is empty, i.e., EF( Q i = 0). We show that a well-formed system is not mandatorily stable, i.e., well-formedness is not a sufficient condition for stability. Proposition 6 Given a set of peers {P 1,...,P n }, its well-formedness does not imply that this set of peers is stable. Proof. This can be proved by demonstrating that a well-formed system can be unstable. We illustrate this through the example depicted in Figure 5. Suppose that one peer in the system contains a cycle φ = s k σ i s k i, where σ Σ+ a and σ contains at least one send message. In this example, one RR n 8561

19 16 Salaün & Ye such cycle is σ = a!.b! in peer 1. Furthermore, there is at least one receive message corresponding to one send message in φ, denoted by m k?, in another peer with a preceding send message m t!, such as a? or b? in peer 2, that is the reception of the emission a! or b! in peer 1, with a preceding emission c!. Suppose further that the execution of the cycle φ is totally independent of the send message m t!, i.e., φ can continue to execute regardless of the emission of m t, and that there is no constraint on m t!, i.e., m t can be emitted at any moment. This is the case for our example, where the cycle a!.b! is independent of c! whose execution is however possible at any moment. For such a system, we can deduce that it is not stable due to the cycle of emissions in peer 1 that can infinitely send messages, which generates new observable behaviors in LTSa k+1 compared to LTSa, k k N, when c! is still not executed. Furthermore, this system is well-formed because the execution of c! is possible at any moment in peer 2, then all messages in its buffer can be eventually read (cycle of receptions) until the buffer is empty. Although well-formedness does not imply stability, one can check whether a stable system is well-formed for the smallest k satisfying stability for instance. Then, we show below that if a system is both stable and well-formed for some k, it remains well-formed for larger bound q greater than k. Figure 5: A Well-formed yet Unstable System Theorem 3 Given a set of peers {P 1,...,P n }, if k s.t. LTS k a br LTS q a ( q > k) and WF(LTS k a), then we have WF(LTS q a) ( q > k). Proof. Suppose that for the given system, we haveltsa k br LTSa k+1 WF(LTSa). k Its stability ensures that s k Sa, k s k+1 Sa k+1 such that s k br s k+1, and the inverse is also true. Furthermore, the well-formedness of LTSa k means that s k Sa, k Q k i sk, Q k i > 0, there must exist another state s k reachable from s k in LTSa k such that all messages in this buffer are consumed, i.e., Q k i s k, Q k i = 0. Now there are two possible cases for sk+1 Sa k+1 : 1) Q k+1 i s k+1, Q k+1 i = k + 1; 2) Q k+1 i s k+1, Q k+1 i = k + 1. For the first case, s k+1 must also exist in LTSa. k Hence, from WF(LTSa), k for each non-empty buffer in s k+1, there must be another reachable state where this buffer becomes empty. Consider the second case, where we have at least one buffer containing k +1 messages. Since LTSa k br LTSa k+1, then s k Sa, k such that s k br s k+1. From Lemma 1, we have LS(s k+1 ), i.e., it satisfies the two conditions described in Definition 9. From the first condition meaning the existence of a confluent diamond, it can be deduced that from such a s k+1, we can reach a state that is also contained in LTSa. k Hence, with WF(LTSa), k it follows that for s k+1 in the second case, for each non-empty buffer, we can find another reachable state where this buffer is empty. Thus, we have WF(LTSa k+1 ). Now from LTSa k br LTSa q ( q > k), we have LTSa k+1 br LTSa k+2. Furthermore, we have proved WF(LTSa k+1 ). Thus, similarly, we can prove WF(LTSa k+2 ) and also WF(LTSa), q ( q > k). Inria

20 Stability of Asynchronously Communicating Systems 17 Finally, we show that the stability results cannot be used for checking properties involving not only emissions but also receptions. Proposition 7 Given a set of peers {P 1,...,P n }, if this system is stable, i.e., k s.t. LTS k a br LTS q a ( q > k), and for some property P, LTS k a = P, then we do not have necessarily LTS q a = P ( q > k). Proof. Consider the example in Figure 2. As explained in Section 1, this system is stable from k = 2. Suppose now that the property under consideration is that it is forbidden to have three successive receptions of log. This property is verified on LTS 2 a but not on LTS 3 a, because to have three successive receptions of log, this peer requires a buffer with size at least three. Therefore, the property is satisfied for LTS 2 a, but is violated for LTS 3 a. 4 Tool Support In this section, we first present our method for checking whether a set of LTSs is stable. Our approach relies on an encoding into process algebra on the one hand, which is used for computing peer synchronous and asynchronous compositions, and on heuristics and search algorithms for computing the smallest bound satisfying the stability property on the other hand. These different aspects will be introduced in this section as well. Finally, we will comment on experiments we made either on real-world examples taken from the literature or on hand-crafted examples to see how our approach scales. 4.1 Method First of all, we introduce some methodological aspects that put in practice the results on systems stability we have presented in the former section. Figure 6 overviews the main steps of the overall approach. Given a set of peer LTSs, we first check whether this system is branching synchronizable [39]. If this is the case, it means that the observable behavior for the synchronous and asynchronous composition always remains the same whatever buffer size is chosen. Therefore, in such a case, the synchronous product can be used for analysis purposes. If the set of peers is not synchronizable, we compute an initial bound k using one of the heuristics we will introduce below (Section 4.3). For that bound, we verify whether the k- bounded asynchronous system is branching equivalent to the (k + 1)-bounded system. If it is the case, the system is stable for bound k. Then, we decrement k for searching the smallest k satisfying the stability property. Thus, we can analyze properties of interest for that system (buffers bounded to the smallest k) and, if they are satisfied, we proved that these properties are preserved for any upper bound. If for a specific k, the equivalence check between the k-bounded asynchronous system and the (k + 1)-bounded system returns false, we modify k (using, e.g., binary search or incremental update of the former bound) and apply the check again. We repeat the process up to a certain arbitrary bound kmax that makes the approach abort if attained. If we reach that bound, the test is inconclusive. The only solution in that situation is to bound arbitrarily the system and analyze the system for that specific bound. RR n 8561